VC++实现注册表监控

//监视HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run项

#include <windows.h>

//定义一个监视注册表启动项的函数
int reg()
{
   HANDLE hNotify;
   HKEY hKeyx;
   //DWORD dwRes;

   hNotify = CreateEvent(NULL, //不使用SECURITY_ATTRIBUTES结构
         FALSE, //不自动重置
         TRUE,   //设置初始状态
         "RegistryNotify" //事件对象的名称
         );

   if (hNotify == 0)
   {
     MessageBox(NULL,"CreateEvent failed"," ",MB_OK);
     ExitProcess(0);
   }

   if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, //根键
         "Software\\Microsoft\\Windows\\CurrentVersion\\Run", //子键
         0, //reserved
         KEY_NOTIFY, //监视用
         &hKeyx //保存句柄
         ) != ERROR_SUCCESS)
   {
     CloseHandle(hNotify);
     MessageBox(NULL,"RegOpenKeyEx failed"," ",MB_OK);
     ExitProcess(0);
   }

   if (RegNotifyChangeKeyValue(hKeyx, //监视子键句柄
         TRUE, //监视此项的子键
         REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET, //监视增加或删除了子键，监视键值发生是否改变
         hNotify, //接受注册表变化事件的事件对象句柄
         TRUE //注册表变化前报告
         ) != ERROR_SUCCESS)
   {
     CloseHandle(hNotify);
     RegCloseKey(hKeyx);
     MessageBox(NULL,"RegNotifyChangeKeyValue failed"," ", MB_OK);
     ExitProcess(0);
   }

   if (WaitForSingleObject(hNotify, INFINITE) != WAIT_FAILED)
   {
     MessageBox(NULL,"注册表有改动"," ",MB_OK);
   }

   CloseHandle(hNotify);
   RegCloseKey(hKeyx);

   return 0;

}

void main()
{
 // DWORD ID;

 // CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)reg, NULL, 0, &ID);   //创建线程

 // printf("ok\n");

	reg();

}

转载于:https://www.cnblogs.com/new0801/archive/2012/10/24/6177697.html